The claim that frontier labs are holding back their best models has six live and six expired examples in ninety days. Our call: the layer of the cut separates them, not how strict the control is. Nobody measures how long each hold lasts

Key takeaways

On September 6 this publication recorded a call in its knowledge graph. The call concerned an argument the supply-chain analyst Dylan Patel made on August 25 on the Dwarkesh Podcast. Using three named examples, Patel argued that frontier labs are holding back their best models. Two of the three examples stopped holding within fourteen days of the talk. The official document that ended them was OpenAI's September 1 post announcing Astra, OpenAI's new model. That post also described the next form of control: the whole model shipped, and only its advanced cyber capability went behind an access list. The September 6 call read that as control changing its unit, from time to capability, and on that basis ruled that the chain of reasoning "control suppresses the labs' ability to bid for compute, and therefore slows concentration" had no current example.

This piece takes that call apart and re-tests it. The result has three layers. First, the one item the call marked "no conclusion found" had an answer sitting on this publication's own graph for eighteen days. Patel's third example was that Anthropic has not released the model its safety evaluation calls Model 2. The graph entry verified on August 19 records Anthropic's own statement that a model called Model 2 improves noticeably on Mythos 5, Anthropic's flagship at the time, on many internal tasks, and is deliberately not released. Anthropic also says the model shows no clear overall capability advantage. Two details rest only on secondhand accounts that agree in direction. One is the framing that Anthropic's August 14 risk report lists three unreleased frontier or near-frontier models. The other is the sentence that there are no current plans to release Model 2 externally. Neither was checked against the primary PDF this round. This publication did fetch the official PDF on August 19, but the verbatim comparison covered sections 3.4.3, 5.2.3 and 5.2.4 of the report, and the Model 2 release sentence is not in those sections. Second, the "changed unit" reading does not stand, because both units were alive in the same window. Within ninety days, the thing being held was cut at four different layers: a whole model, a separate model variant, one capability domain, and one tier of reasoning compute. Each has a named example, and the examples span five companies. Nothing replaced the old unit. Both units were in use in the same window. Third, what decides which layer the cut lands on is not how strict the control is but whether the release channel can be cut at all. The cleanest evidence comes from one company, one model, one day. On August 14, China's Z.ai released GLM-5.3 with the hosted service open, the most sensitive functions behind an access list, and the downloadable weights held for fourteen days. The weights are one block. A single capability cannot be held back inside them.

The piece runs in six steps:

1. Check the answer first: the item marked "no conclusion found" has an answer on this publication's graph, and the answer points the other way.

2. Break "unit" into a table of cut types and name an example for each cell.

3. Explain why a release lands where it does: whether the channel can be cut decides which cuts are available.

4. Lay out every time reading in the ninety days, then show why none of them is a delay.

5. Answer the original question directly: does the chain "control suppresses compute bidding" hold or not?

6. So which number to ask for, from whom, and what would overturn this piece.

The September 6 call ran in the daily brief. What this piece adds comes to three things, each traceable. First, the "changed unit" reading was tested and did not survive. The test was to look for examples of the old unit inside the same window. Six turned up across five companies, and two of them had been public for more than three weeks on the day the call was written. Second, the denominator behind the number "two weeks" was broken out. The ninety days hold six windows: four with a measurable length (two days, thirteen days, fourteen days, fourteen days) and two still open today. Not one of the four is a measured delay. Each is a window the vendor announced itself, measured from opening to closing, and no vendor has published the comparison point, the date the model was originally due to ship. Third, the condition that overturns this piece is written down. As soon as any vendor publishes a model's planned ship date next to its actual ship date, this piece's conclusion that "there is no ruler" is wrong, and the chain of reasoning becomes something that can be computed that day.

The tree is this publication's map of how dual-use cyber capability gets allocated. This piece does not rule on any of the branches. The subject is the layer beneath them that the map skips: in the same period, alongside the cyber capability domain, three entirely different kinds of cut were in use at the same time, and the map draws only one of them.

If this is the only part read: the question for a model vendor now has a standard form. What was this model's planned ship date, what was its actual opening date, and was the thing held back the whole model or one part of it. No vendor publishes the first two numbers today. Every vendor publishes the third.

One: check the answer first. The item marked "no conclusion found" has an answer on this publication's own graph

On September 6 the three examples from August 25 were checked one by one. The result was two expired and one with no conclusion. The third example was that Anthropic has not released the model its safety evaluation calls Model 2. The September 6 call wrote explicitly that this item was the most likely to overturn the whole call, and that no conclusion could be found that day.

The answer exists in three places at once.

The first place is Anthropic's own official document. On August 14 Anthropic published its second company-wide risk report, covering the period to July 15. The report lists three frontier or near-frontier models that were unreleased at the time. The first is Claude Opus 5, which shipped on July 24. The second is Model 1, roughly on a par with Mythos Preview and Mythos 5. Mythos is a separate Anthropic model line from Claude Opus, and Mythos 5 was Anthropic's flagship at the time. Anthropic says Model 1 is not expected to see wide deployment, externally or internally. The third is Model 2, which Anthropic describes as a noticeable improvement over Mythos 5 on many internal tasks. Anthropic's position, as relayed, is that there are no current plans to release Model 2 externally.

How firmly this passage is sourced needs stating precisely, because its parts do not rest on the same evidence. The framing that the report lists three unreleased frontier or near-frontier models, and the sentence that there are no current plans to release Model 2 externally, rest this round on several secondhand accounts that agree in direction. Neither point has been checked against the primary PDF this round.

The second place is this publication's graph. The report entered the graph on August 18 through a long-form reader of Anthropic's documents, Zvi Mowshowitz. On August 19 the official PDF was fetched from anthropic.com and compared verbatim. Confidence moved from 0.6 to 0.8, and the entry records that Model 2 scored 62.8% on one internal diagnostic test, against 54.8% for Mythos Preview and 50.3% for Mythos 5, all three figures from Anthropic's own report. That entry was already in verified status eighteen days before "no conclusion found" was written on September 6. One caveat: that verbatim comparison covered sections 3.4.3, 5.2.3 and 5.2.4 of the report. It did not cover the "three unreleased models" framing above, and it did not cover the sentence about no current plans to release the model externally.

The third place is the news coverage. Between August 14 and 15 several technology outlets reported the same document under headlines to the effect that Anthropic has a stronger Claude and has no plans to ship it. Of those, only two secondhand accounts can be named here: Unite.AI, and a repost on LessWrong. So no count of outlets is given, and this item carries no weight in the argument. It was always only the third place.

So the graph already held the answer. The item had simply not been looked up. And once looked up, the answer runs the other way from the original call. The premise that frontier labs are holding back their best models is, at Anthropic, confirmed in Anthropic's own written report, and open-ended. There is no window and no condition, only the statement that there are no current plans.

But the item needs one deduction before it can be used. Anthropic's own description of Model 2 carries two qualifiers. The improvement is primarily tied to internal tasks, and, in the report's words as relayed by Mowshowitz, Model 2 "does not display a capability jump of the degree observed from Claude Opus 4.6 to Mythos Preview". The available safety evaluations show no clear overall capability advantage. By Anthropic's own assessment, the model being held back is not a clearly better product. That sentence matters for section five, because the chain "holding back the best model stalls revenue per megawatt" needs the thing held back to be something that would sell for more.

Two: break "unit" apart. The thing being held can be cut at four different layers

Section one dealt with one type of cut. Widening the window to ninety days, the question becomes: how many shapes does "being held" come in?

Two dimensions have to be set out first, because the rest of the piece runs on them.

The first dimension is which layer the cut lands on. A release can be cut at four places:

• The whole model: this model does not ship, or ships later.
• A separate model variant: the main model ships, and a sibling without the restrictions is built as a second model that carries no public price.
• One capability domain: the same model ships, but one class of work (advanced cyber, for example) goes through a separate application gate.
• One tier of compute: the same model ships, but the highest tier of reasoning compute stays closed.

The second dimension is what closes the gate. There are only two: time (not now, on some date) and a list (now, but only for those who pass review).

With the examples from the ninety days filled in across four cut types and two gate types, all but two combinations have an occupant:

Two cells read "none found in this window". The scan covered the public release announcements and main secondhand accounts of five companies, Anthropic, OpenAI, Google, Meta and Z.ai, over these ninety days, and no example of those two combinations turned up. That is "searched and not found", not proof that none exists.

This table is the answer to the "changed unit" reading. The September 6 call saw one cell, a capability domain gated by a list (OpenAI's cyber capability), and read it as a move out of the whole-model row. In fact the whole-model row has four examples in the same window across three companies, and two of them had been public for more than three weeks on the day the call was written. Those two are Anthropic's Model 1 and Model 2, which count together as one example, and Z.ai's hold on the GLM-5.3 weights.

Nothing was swapped out. The table got filled in.

The difference changes what the next piece of news that "some company held back a model" calls for. If the unit had really changed, tracking the new unit would be enough. If the table got filled in, every such item has to be asked which layer the cut landed on and what closed the gate, because different cuts have entirely different consequences. That is exactly what section five deals with.

Three: why a release lands where it does. Whether the cut is possible is decided by the release channel

With the table in view, the next question is who decides which cell a release lands in.

The intuitive answer is that stricter control means a bigger cut. That answer is wrong, and there is a counterexample clean enough to work almost like a controlled experiment.

On a single day, Z.ai handled one model in two opposite ways.

On August 14, China's Z.ai released GLM-5.3. In Z.ai's own words on the model card: "As we scaled post-training, cyber capability developed faster than we expected." On Z.ai's self-reported scores, GLM-5.3 reached 84.5% on CyberGym, a vulnerability-discovery test, slightly above Anthropic's list-gated Mythos 5 at 83.8% and OpenAI's GPT-5.6 Sol at 83.6%. On ExploitBench, a test that requires writing working exploit code, GLM-5.3 scored 54.4% against 78.0% for Mythos 5.

The same day, Z.ai handled this one model in two entirely different ways:

• The hosted service opened as normal. Access runs through paid plans and the coding product, and the most sensitive functions sit in a separate trusted-access tier for selected cyber partners. That is "cut one capability domain, gate it by a list."
• The downloadable weights were held. The stated reason was safety evaluation and hardening first. The weights came out two weeks later, on August 28, under a custom licence; the smaller Flash version came out on August 26 under an MIT licence. That is "cut the whole model, gate it by time."

Both handlings are known here from secondhand accounts. The hosted tiering comes from a report by implicator.ai, and the weights timeline from a check by The Batch. Z.ai's own announcement has not been reviewed.

Why did Z.ai restrict the hosted service by capability but the weights by date? Because the two channels differ in whether they can be cut.

A hosted service is a channel the vendor holds in its hand. Who calls, what they call, whether they may call: every request passes through the vendor's servers. Closing only one class of work is technically straightforward. It takes one permission check.

Downloadable weights are a single block. There is no switch inside a weights file labelled "cyber capability." That sentence needs narrowing by one step. The industry has tried to lock capability into weights; refusal training and capability tiers are exactly that. But that approach applies to every downloader alike, and it does not stop someone from downloading and then training the lock back out. What cannot be done is routing by recipient: letting only reviewed parties have the full capability. The weights channel has no switch of that kind. Once the download completes, the model is on the other party's machine, the vendor cannot see what is being done with it, and there is nothing to revoke. For that channel, "close one capability domain" is not an option. The only variable left is when to release.

So the knife is not chosen by the strength of the control. It is chosen by whether the thing can be cut. Applying that rule back to the table in section two, all four cut types line up:

• Anthropic's Model 1 and Model 2 sit in the whole-model row not because the control is strictest but because those two models have no release channel at all. Neither model has a launch, a price or customers. When a thing has no product surface, "cut off a part and sell it" is meaningless, and the only options left are release or do not release.
• Anthropic's Mythos and Google's Flash Cyber sit in the separate-variant row because those companies chose to implement "the unrestricted part of the capability" as a second file rather than a gate inside the same model. This is the sibling-model pattern that this publication's deep dive of September 4 already described. What this piece adds is that the sibling is also a kind of cut, with the incision on the model boundary instead of the feature boundary.
• Meta's max reasoning tier sits in the compute-tier row because the thing Meta wanted to close was already an ordered, adjustable parameter. Reasoning effort is a setting, and a vendor can cap it at xhigh. This is the cheapest cut of all: no new model, no new gate, only a changed ceiling.
• The US government's request on GPT-5.6 sits in the whole-model row because the party making the request is not on the channel. What the government wanted was thirty days to look before release. Its concern was whether the whole system posed a national-security risk, not one class of work, and it had no tool that could close one capability domain.

This section has one limit. The rule above, that the channel decides the knife, is this publication's inference, not any party's statement. No company has said "the weights cannot be cut, so delay was the only option." Z.ai's announcement that day said only that cyber capability had developed faster than expected, and did not explain why the hosted and weights channels were handled differently. Reading the two handlings side by side as two outcomes of one constraint is this publication's addition. Section six writes it in a form that can be overturned.

Four: lay out every time reading, then show why none of them is a delay

The skeleton of the September 6 call was one number: fourteen days. Announced August 18, shipped September 1. The number was used to argue that this kind of restraint cannot last long.

Here are all the cases in the window with a start and end date:

This looks like the denominator behind "two weeks": four finite windows of two to fourteen days, and two open-ended ones.

But the table cannot be used that way.

Not one of the four finite windows is a measured delay. Each is a window the vendor announced on its own initiative, measured from announcement to close:

• OpenAI said on August 18 that the pause would be about two weeks. Training restarted on August 28 and Astra shipped on September 1. The window closed on schedule. It measures an announcement kept, not a delay. OpenAI's Astra post says that on August 28 OpenAI restarted the large frontier training run that had been paused (OpenAI, 2026-09-01).
• Meta said on September 2 that max was still in extra safety testing and would arrive soon. It arrived on September 4, as announced. That max was genuinely not open at the time is known here from VentureBeat's report.
• Z.ai said on August 14 that the weights needed a safety evaluation first and would follow in two weeks. The weights arrived on August 28, as announced.
• GPT-5.6 is subtler. Partners only from June 26, public on July 9. The start of the restricted period is confirmed here directly from TechCrunch's report that day; the public date comes from secondhand summaries. But nobody has published the date on which GPT-5.6 would have gone public had the government not asked. Thirteen days measures "restricted release to public release", not "thirteen days later than planned".

A delay needs two dates: when the model would have shipped, and when it actually shipped. All the public data gives only the second.

A company that announces a two-week pause and comes back two weeks later shows the same reading on paper as a company where nothing happened, because nobody knows what those two weeks would otherwise have contained. A model due in July that actually ships in September, by contrast, loses two months that really vanish from the market. Those months show up in revenue, in compute utilisation, and in the catch-up window of competitors.

No company publishes the first date today. The official announcements and main secondhand accounts were checked for five cases: the Astra training pause, the GLM-5.3 weights, the Muse Spark max tier, the restricted GPT-5.6 release, and the vendors' cyber access lists. Anthropic's two models in the table above are not on that list, because Anthropic never announced a window for them. The result across all five is only "now open" or "opening soon". Not one says "relative to the original plan".

One aside: the table has two fourteen-day entries. That is coincidence, not pattern. One is a self-announced training pause and the other a weights-hardening period, two different mechanisms with two cases in total, and nothing in this piece is built on it.

Five: does the chain "control suppresses the ability to bid for compute" hold or not?

Now the original question can be answered.

The chain was recorded in this publication's knowledge graph on August 28. It runs: hold back a release, rival models catch up, revenue per megawatt stalls, compute becomes unaffordable, concentration slows on its own. Its point was to read release policy as a lever on compute allocation, not just a safety lever. The September 6 call said the chain had no current example.

That sentence was wrong by a wide margin. There are at least six current examples, named one by one in the two sections above. The strongest of them even comes with the words of the party being controlled. OpenAI's public response to the government request on June 26 was that the process keeps the best tools from the users, developers, enterprises, cyber defenders and global partners who need them, and that OpenAI does not believe this kind of government access process should become the long-term default. That is the first link of the chain, stated by the party being held back.

But "there are examples" is not "the chain holds". Running the six examples through the chain one by one gives this:

The first group: the thing held back has no revenue surface. Anthropic's Model 1 and Model 2 are held open-ended, which sounds most like what the chain needs. But neither model ever had a launch plan. Anthropic's report says Model 1 is not expected to see wide deployment and Model 2 shows no clear overall capability advantage. Not selling a thing that was never going to be sold does not stall revenue per megawatt. This group contributes nothing to the chain.

The second group: the thing held back is one narrow revenue line. The vendors' cyber access lists close off advanced cyber workflows. "Defenders" here means the side doing cyber defence, as against attack or penetration testing. This is the part the September 6 call got right, and this piece keeps it: the whole model is on sale and monetised, only one slice is held, and the vendor has even set aside a separate US$1 billion in credits to subsidise the defenders left outside. What this group contributes to the chain depends on what share of revenue that line is, and none of the three vendors discloses that denominator. The September 6 call listed this as the item with the least ground under it. Across the public material of all three vendors, that share is still undisclosed today.

The third group: the windows are too short. The finite windows ran from two to fourteen days. Even counting all of them as real delays, which section four says cannot be done, they add up to less than a month. The chain itself is about compute share in 2028.

So the conclusion is: the chain is today neither confirmed nor overturned. It has examples. What it lacks is a ruler: a planned ship date to measure each hold against.

This conclusion points the same way as the September 6 call, but for an entirely different reason, and the reason decides what happens next. If the problem is a lack of examples, the move is to wait for the next event. If the problem is a lack of a ruler, waiting produces no answer however long it lasts. The move is to ask for the number nobody is giving.

One more thing has to be set alongside, because it runs against the chain's direction. The chain's force, by its own terms, depends on an exogenous variable: how fast open weights catch up. What happened in these ninety days is that the open-weights side ran into the same gate. Z.ai held the GLM-5.3 weights for two weeks because cyber capability exceeded expectations, and Z.ai held the whole block. If that becomes normal on the open-weights side, the chain's exogenous variable is no longer exogenous: control is pressing on both sides at once, and the two sides are pressed into different shapes. This piece does not rule on whether that becomes normal. One company has done it once, the sample is too small, and this piece only records the first occurrence.

The two score pairs in section three carry a second reading for buyers. On the vulnerability-discovery axis, the lead of the list-gated model is already thin, but on the write-working-exploit axis the gap is still wide, so the question "is there a substitute source for the capability the list holds back" has to be answered per capability axis today. One more contrast sits in the same evidence without having been interpreted. On one side, a government compelled a domestic vendor to delay a whole line. On the other, a vendor voluntarily held its weights for two weeks. This piece does not rule on whether that compelled-versus-voluntary asymmetry is a structural disadvantage, because each side has one case, and judging it needs exactly the number this piece cannot find, the planned ship date.

Six: so the number to ask for, and from whom

Companies buying frontier models

The "model availability" clause in a procurement contract does not protect what the buyer actually wants, and the gap is wider than the September 6 call described. That call said: the whole model arrives on time, and what gets pulled out is a sub-capability. What this piece adds is a second thing: the score shown at the launch event may come from a configuration the buyer cannot call.

Two cases sit side by side in the first two weeks of September. Meta released Muse Spark 1.3 on September 2. The most striking results came from the max reasoning tier, and the ceiling developers got that day was xhigh. Artificial Analysis, an independent firm that benchmarks models across API providers, said it had measured max in a limited partner preview, and at that time no API provider listed the configuration. OpenAI's official Astra post of September 1 carries its own note on its cyber results: "Astra results shown reflect capabilities with Daybreak Blue access, not the default production configuration." (OpenAI, 2026-09-01)

Two companies in one week show the same structure: the public number and the purchasable configuration differ, and the difference is written in a footnote. Both companies labelled the difference, so neither is hiding it. It is the unavoidable side effect of cutting at the capability layer or the compute layer: when the thing held back lives inside the model, the model on the launch stage and the model in the buyer's API carry the same name.

So the three questions a buyer now puts to a vendor, in order:

1. Which configuration produced this score, and can a standard account call that configuration?

2. Is the part the account cannot call behind an application gate (a list) or a schedule (time)? The two answers mean entirely different things: the first may never come round, the second at least has a direction.

3. What was this model's planned ship date? This question gets no answer today, and it starts getting one only once enough buyers ask it.

Compute pricing and capacity commitments

The first step is to settle which cut type a control uses, before reacting to the news. The September 6 call said that a whole-model cut should be read through the chain. It said a cut on the capability axis carries almost no signal. This piece narrows that to a more usable test: whether the thing held back has a revenue surface, and whether the window is open-ended.

Only one combination on the table moves compute demand: whole model, open-ended, and a model that was due to ship. In the ninety days that cell is empty. Anthropic's two models are open-ended, but they were never going to ship. Every other example either has a revenue surface with a window measured in days, or an open-ended window with no revenue surface.

Policy design

One side effect belongs in any assessment: a requirement of "thirty days to look before release" asks for the whole-model row, and the only behaviour the industry changes in response is to move more into the three rows that can be cut. Those three rows all count as equally responsible under current governance. But the gap they create between the public number and the purchasable product appears in no compliance document. None of the three procurement questions above is required by any disclosure framework today.

Our call

Frontier control did not change its unit. Control now fills a table: the thing held back can be cut at a whole model, a separate model variant, one capability domain, or one tier of compute, and the gate is closed by one of two things, time or a list. Which combination of cut and gate a release lands in is decided by whether the release channel can be cut, not by how strict the control is. And how long each cell is held, nobody measures today: every public figure is a vendor's own announced window from opening to closing, and not one is a delay computed against the date the model would otherwise have shipped. So the question "will control suppress the frontier labs' ability to bid for compute" is today neither confirmed nor overturned. The question simply has no ruler yet. From here on, every report that "some company held back a model" gets three questions from this publication first: which layer the cut landed on, whether the gate is time or a list, and whether anyone can supply the planned ship date.

What would prove this wrong

1. Any vendor publishes a planned ship date next to an actual ship date. This piece's conclusion that there is no ruler is void that day, and the chain "control suppresses compute bidding" moves from unjudgeable to computable. This is the only number the piece actively asks for.

2. A case appears in the cell "whole model, open-ended, due to ship". That is, a flagship with a price and customer expectations held back indefinitely. The chain would get its first genuinely qualifying current example, and section five's three groups would have to be rewritten.

3. Any vendor discloses the share of revenue from the restricted capability domain. If it is significant (above a tenth, say), "only one narrow revenue line is held back" fails, and section five's second group flips. From September 6 to today that share has had zero readings.

4. A counterexample to "the channel decides the knife" appears. Concretely: a vendor manages to close a single capability domain inside downloadable weights rather than delaying the whole file, or a vendor on a hosted channel it fully controls chooses to delay the whole model over a concern about a single capability domain. Either one, and section three's mechanism has to be replaced.

5. The Z.ai case turns out to have a different cause. If later disclosure shows the weights delay was driven by export controls, commercial scheduling or licence negotiations rather than the safety evaluation Z.ai stated, section three's core evidence, two knives on one day, no longer stands, and the mechanism drops back to conjecture.

Written from the same research and judgments as the Traditional Chinese edition. Sources are linked; we distinguish original documents from reporting and mark what we could not verify.

Sources cited in other language editions

These sources are linked in the body of this piece's other language editions but not in this one.

• deploymentsafety.openai.com/gpt-6-astra
• x.com/ZeffMax/status/2089787624580104535
• helpnetsecurity.com/2026/08/19/openai-model-safety-updates/